Denial-of-Service Issue in Vanetza Open-Source Implementation

CVE-2026-43988

What is CVE-2026-43988?

A denial-of-service vulnerability exists in the ASN.1/OER parsing pipeline of Vanetza, an open-source implementation of the ETSI C-ITS protocol suite. When malformed network packets containing corrupted ASN.1/OER structures are processed, the ASN.1 wrapper (asn1c_wrapper.cpp) raises a std::runtime_error. This exception is not handled properly at the parsing boundary, leading to the termination of the process when std::terminate is invoked. The issue has been addressed in a recent commit.

References